VPC & IP Topology¶
Forward design — peering stays for DO regions; Mass Relay where it can't reach
The control-plane↔regional peering below carries only dashboard reads + retention upserts, and stays permanently for DO regions (intra-region $0; cross-region $0.01/GiB, private, zero ops). Regions on clouds without DO peering use Mass Relay (§39.3 #43) — an egress-only query channel dialing out from the telemetry droplet — so the architecture extends to any cloud with no new networking primitives; it also serves as the emergency transport for a peered region during a prolonged peering outage. The #46 non-overlap constraint stays for peered (DO) regional VPCs.
One shared VPC per region, sized /16 (DO max, 65,531 usable).
- A region's customer clusters, their resold DO Managed DBs, the telemetry VM droplets, and LBs all live in it.
- Tenant isolation is namespace + NetworkPolicy + the server-side query filter — not the VPC — so clusters share the regional VPC safely.
- Peerings scale with regions, not clusters: the control-plane VPC peers each regional VPC once (~12 peerings at 12 regions, far under DO's 50/account); that peering carries only the thin cross-region dashboard reads (FR-071), never the ingest firehose.
Self-managed Talos with Cilium overlay (VXLAN + masquerade) — customer pod egress is SNAT'd to the node IP, so a pod reaches its Managed DB as the node IP (not the pod IP).
- Each dedicated customer DB (Micronova+ tiers) is isolated two ways: Trusted Sources scoped to the cluster/node tag of the clusters hosting its environment's services in that region (DB-side, cluster-granular), plus a per-environment egress allowlist rendered by Shuttle — the actual per-tenant boundary, enforced by Cilium before SNAT — so only the owning environment's pods reach the endpoint (FR-075, Managed Databases).
- Mininova throwaway DBs are in-cluster pods behind the namespace's env-scoped NetworkPolicies and never touch the VPC layer.
- Customer regions are never peered to each other — only the control-plane VPC peers each regional VPC — so cross-region private traffic has no path; this is the physical basis of FR-078 (no cross-region private networking; databases are region-local).
IP plan:
| Range | Size | Holds |
|---|---|---|
| Regional node VPC | /16 |
cluster nodes + customer Managed DBs + LBs + telemetry + ops/jump (later Shipyard) droplets |
| Per-cluster pod CIDR | overlay | Cilium VXLAN — cluster-local, reusable across clusters |
| Per-cluster service CIDR | overlay | cluster-local, reusable |
Because Cilium runs in overlay mode, pod/service CIDRs are not routable on the VPC and can be the same
on every cluster (encapsulated with node IPs) — so they consume no VPC address space and need no systematic
allocation. The regional /16 holds only real infrastructure (nodes, DBs, LBs, telemetry, Shipyard). The
IPAM registry (§39.3 #46) shrinks to allocating regional-VPC ranges
non-overlapping with the control-plane VPC (for the peering). The practical scaling knob is the DO droplet
quota (§39.3 #47).
Cross-references
Cluster topology (what runs in the VPC) → §4 · the traffic path that lands here → §5 · cross-region telemetry reads over peering → FR-071 / v2 Read & query. Canonical map: Canonical Sources.